snapshot of https://github.com/ory/kratos.git (master, 2026-09-15; blobs > 131072B omitted)

selfservice/strategy/deviceauthn/attestation_test.go

@@ -0,0 +1,44 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package deviceauthn_test
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tidwall/gjson"
+
+	"github.com/ory/kratos/selfservice/strategy/deviceauthn"
+)
+
+func TestAndroidKeyDescriptionJSON_dropsChallengeAndUniqueID(t *testing.T) {
+	desc := deviceauthn.AndroidKeyDescription{
+		AttestationVersion:       3,
+		AttestationSecurityLevel: 1, // TEE-backed.
+		AttestationChallenge:     []byte("nonce"),
+		UniqueID:                 []byte("hardware-id"),
+		TeeEnforced: deviceauthn.AndroidAuthorizationList{
+			AttestationIDManufacturer: []byte("Google"),
+		},
+	}
+
+	out, err := json.Marshal(desc)
+	require.NoError(t, err)
+
+	res := gjson.ParseBytes(out)
+	assert.Equal(t, int64(3), res.Get("attestation_version").Int())
+	assert.Equal(t, base64.StdEncoding.EncodeToString([]byte("Google")), res.Get("tee_enforced.attestation_id_manufacturer").String())
+	assert.False(t, res.Get("attestation_challenge").Exists(), "challenge is verified at enrollment, not serialized")
+	assert.False(t, res.Get("unique_id").Exists(), "unique id is privacy-sensitive, not serialized")
+}
+
+func TestKeyAttestationOmitemptyWhenNil(t *testing.T) {
+	k := deviceauthn.Key{ClientKeyID: "abc"}
+	out, err := json.Marshal(k)
+	require.NoError(t, err)
+	assert.False(t, gjson.ParseBytes(out).Get("attestation").Exists())
+}